摘要
提出了一种基于正态分布进行异常流量检测,从而判断当前内网中是否存在蠕虫感染的方法。该方法根据历史流量的正态分布统计特性,计算出网络内数据流量的一般行为的可信区间,如果监控的流量超出该可信区间,则判断为异常流量并作出蠕虫威胁的报警。结合该方法,进一步分析了如何以双因素模型分析网络中蠕虫的数量。
This paper raised a method detect the abnormal net-flow based on normal distribution, then estimated the existence of Internet worm in internal network. According to the normal distribution character of the history flow, this method computed the normal behavior trusted zone of data flow in network, judged the inspected flow abnormal flow if it went beyond the trusted zone, and alarmed the threat of Internet worm. Combined with this method, further analyzed how to use two-factor model analysis of the number of Interuet worms in network.
出处
《计算机应用研究》
CSCD
北大核心
2010年第3期1032-1034,共3页
Application Research of Computers
基金
国家"863"计划资助项目(2007AA01Z197
2008AA01Z416)
关键词
正态分布
异常流量
可信区间
蠕虫
normal distribution
traffic statistic
trusted zone
worm